/**
 * Entra ID (Azure AD) authentication for the agent.
 *
 * Token lifecycle:
 *   1. Check ~/.agentlink/entra-token.json cache
 *   2. If valid → return silently
 *   3. If expired but refresh token valid → silent refresh
 *   4. Otherwise → interactive browser flow (opens system browser)
 *
 * Uses acquireTokenInteractive which opens the system browser on the managed
 * device, satisfying Conditional Access / Intune device compliance policies.
 * The cached token file stores the MSAL token cache serialized by msal-node.
 */
export declare function loadCache(): void;
export interface EntraToken {
    idToken: string;
    email: string;
    oid: string;
}
/**
 * Acquire an Entra ID token for agent authentication.
 *
 * Strategy:
 *   1. Try silent (cached/refresh) → no user interaction
 *   2. If interactive needed:
 *      - Opens system browser for login (satisfies Conditional Access)
 *      - No TTY requirement — browser handles the UI
 */
export declare function acquireEntraToken(allowInteractive?: boolean): Promise<EntraToken>;
/**
 * Re-acquire a fresh token (e.g., when the server reports token_expired).
 * Forces a refresh from cache, or interactive if refresh fails.
 */
export declare function refreshEntraToken(allowInteractive?: boolean): Promise<EntraToken>;
/**
 * Parse the basic claims from an ID token (JWT) without full verification.
 * Agent doesn't need to verify the token — the server does that.
 */
export declare function parseIdTokenClaims(idToken: string): {
    oid: string;
    email: string;
};
/**
 * Check if there is a cached Entra token without acquiring one.
 */
/**
 * Extract the `exp` claim (Unix timestamp) from a JWT without verification.
 */
export declare function getTokenExp(idToken: string): number | null;
/**
 * Check if a JWT token is expired (based on `exp` claim vs current time).
 */
export declare function isTokenExpired(idToken: string): boolean;
export declare function hasCachedToken(): Promise<boolean>;